# Data retention and security

> What the Fileverity API stores and for how long: uploaded files, results, text, request logs and webhook deliveries, and how keys and endpoints are protected.

Source: https://fileverity.com/en/docs/security

This page lists what the API keeps and for how long. For the wider picture, see [Trust and security](https://fileverity.com/en/trust).

## Retention

| Data | Kept | Notes |
| --- | --- | --- |
| Uploaded files | Deleted when an analysis starts, and at the latest after 24 hours | Stored privately. `DELETE /files/{id}` removes a file sooner. |
| Text you send to `POST /text/detections` | Not stored | Evaluated and discarded. It is never stored, so it cannot be retrieved later. |
| Text detection results (never the text) | 7 days | Verdict, scores, passage offsets and usage. Shown in Past checks in the Console. Test keys record nothing. |
| Analysis results | 7 days | Then the result is removed. The verification record of the report remains available. |
| Document evidence (page images, text excerpts) | 3 hours | Download the PDF report before then to keep the evidence in it. |
| Request logs | 30 days | Method, path, status, duration, error code and key. Not request or response bodies. |
| Webhook delivery logs | 30 days | The event payload, status, response time and the first 2 KB of your endpoint's response. The latest 50 are shown in the Console. |
| Idempotency records | 24 hours | The saved response, used to replay a retried request. For text detections it is the result without the text. |

## Protection

- **HTTPS only.** All API traffic uses HTTPS.
- **Keys.** Only a SHA-256 hash and the last four characters of a key are stored. Keys can be revoked at any time. See [Authentication and keys](https://fileverity.com/en/docs/authentication.md).
- **Workspace isolation.** Files, analyses, keys, webhooks and logs belong to one workspace and one mode; live and test keys cannot read each other's files.
- **Spend limits.** Per-key monthly limits cap what a leaked key can spend.
- **Webhooks.** Deliveries are signed with a per-endpoint secret. Endpoints must use HTTPS and public addresses; private and internal addresses are refused. Redirects are not followed.
- **Verifiable reports.** Image and document reports carry a report ID, SHA-256 fingerprints and an RFC 3161 timestamp, and have a public verification page.

## Enterprise

Private deployment is available to Enterprise customers on request. [Contact us](https://fileverity.com/en/contact) to discuss it.

## Legal

See the [Privacy policy](https://fileverity.com/en/legal/privacy), the [Terms of service](https://fileverity.com/en/legal/terms) and the [Data processing agreement](https://fileverity.com/en/legal/dpa).